Privacy notice
This notice explains what personal information Kenstow collects, why, who receives it and how long it is kept.
Who is responsible
Kenstow is operated by [Operator full name]
38 Porter Road, Basingstoke, RG22 4JS, United Kingdom
[contact email address]
For the account details you give us (your email address and your company’s name) we are the data controller. For the documents and other content your company puts into Kenstow, your company decides what is stored and why. We process that content on your company’s behalf, under the data protection terms in our Terms of service.
What we collect
| Information | Examples | Why |
|---|---|---|
| Account details | Email address, password (held in hashed form by our sign-in provider), company name, your access level | To create and run your account |
| Your company’s content | Uploaded files, document titles and numbers, text read from documents, filing categories, cases, questions, discussion messages, proposed and approved revisions, recorded decisions, notes | To provide the service |
| Usage records | Which action was run (for example a question or a case), when, by whom, how large it was, and a short label such as the question or file name | To show your monthly usage and keep the service within each plan’s allowance |
| Technical information | IP address, browser type and request details, kept by our hosting providers’ systems | To run and protect the service |
| Messages to us | Anything you send to [contact email address] | To reply to you |
Documents may contain personal information about your colleagues, customers or suppliers, for example names on approval records. Please upload only what you need.
How we use it, and why we are allowed to
- To provide the service you signed up for (performance of a contract).
- To keep Kenstow secure, prevent abuse and measure usage fairly (our legitimate interests).
- To keep the records the law requires, such as tax records (legal obligation).
We do not sell personal information, we do not use it for advertising and we do not send marketing emails. The emails we send are about your account, such as sign-up confirmation and password reset.
How your documents are analysed
To find the documents a request affects, answer a question or write a proposed change, Kenstow sends the request and short excerpts of the relevant documents to a language model provider, Anthropic. Only the excerpts needed for that request are sent, never a company’s whole library.
- Under Anthropic’s commercial terms (checked 12 October 2026), Anthropic may not train its models on customer content submitted through the service, and it handles that content under its data processing addendum.
- Anthropic’s published default is to delete the inputs and outputs of API requests from its systems within 30 days. It may keep them longer where the law requires, or to enforce its usage policy.
- Kenstow does not train or fine-tune any model on your documents. Each company’s content and recorded decisions are kept separate, and nothing learned from one company is used for another.
- A proposed change to a document never takes effect without a person’s approval.
Who else receives information
Only the companies that help us run the service, listed with their purpose and location on the sub-processors page. We do not share information with anyone else, except where the law requires it.
Transfers outside the UK
Your workspace is stored with Supabase in London. Anthropic is a US company and may process request excerpts outside the UK. Its data processing addendum includes the standard contractual clauses and the UK Addendum for such transfers. The region of our hosting provider is shown on the sub-processors page.
How long we keep information
| Information | How long |
|---|---|
| Account details and your company’s content | While your company’s account is open. An owner can delete the company and all its data at once in Settings, Account. If you ask us to do it, we delete within 30 days. |
| A document you delete | Removed from your library when you delete it. |
| Revision history and approval records | They are your company’s document control records, so they are kept while the account is open and deleted with it. Ask us for a copy before you close the account. |
| Usage records | While the account is open, because the usage page and the monthly allowance depend on them. Deleted with the account. |
| Copies in our providers’ backups | May remain for a short time after deletion, until the provider’s normal backup cycle overwrites them. |
| Billing records (once paid plans start) | 6 years, as UK tax law requires. |
| Messages to us | As long as needed to deal with them. |
You can delete your own sign-in at any time in Settings, Account (or ask us to). Your company and the work you did stay. Approval records that your company needs for document control keep your email address as the approver’s name, because they are your company’s records. The only owner of a company must first make someone else an owner, or delete the company.
Your rights
You can ask us for a copy of your personal information, ask us to correct or delete it, ask us to restrict how we use it, ask for it in a portable form, and object to our use of it. Write to [contact email address]. We reply within one month. If your information is inside a company’s workspace, we may need to pass your request to that company, because it decides what is stored.
If you are not happy with how we handle your information, you can complain to the Information Commissioner’s Office at ico.org.uk.
Cookies
Kenstow uses only the cookie it needs to keep you signed in. See the cookie notice.
Changes
When we change this notice in a way that matters, we update the date at the top and tell account owners by email.